/* RULE IS DELETED!!!

Doing the deleting the fast way; too much stuff to do to deal with the conditional compile crap.

*/

/*
 * alert tcp $EXTERNAL_NET 445 -> $HOME_NET any (msg:"NETBIOS SMB client TRANS response ring0 remote code execution attempt"; flow:to_client,established; content:"|ff|SMB2"; offset:4; depth:5; isdataat:28,relative; metadata:policy balanced-ips drop, policy security-ips drop, service netbios-ssn; classtype:attempted-admin; reference:cve,2005-0045; reference:url,www.microsoft.com/technet/security/bulletin/MS05-011.mspx; sid:17744;)
*/
/*
 * This code was automatically generated by the Sourcefire VRT Rules2C web generator
 *
 * We make no claims to the correctness or fitness of the code generated or of modifications
 * to the generated code.
 *
 * Use at your own risk.
 *
 * Please report any problems with this tool to research@sourcefire.com
 */

#include "sf_snort_plugin_api.h"
#include "sf_snort_packet.h"


/* declare detection functions */
int rule17744eval(void *p);

#if 0
/* declare rule data structures */
/* flow:established, to_client; */
static FlowFlags rule17744flow0 = 
{
    FLOW_ESTABLISHED|FLOW_TO_CLIENT
};

static RuleOption rule17744option0 =
{
    OPTION_TYPE_FLOWFLAGS,
    {
        &rule17744flow0
    }
};
// content:"|FF|SMB%", payload raw, offset 4, depth 5, fast_pattern; 
static ContentInfo rule17744content1 = 
{
    (uint8_t *) "|FF|SMB2", /* pattern (now in snort content format) */
    5, /* depth */
    4, /* offset */
    CONTENT_FAST_PATTERN|CONTENT_BUF_NORMALIZED, /* flags */
    NULL, /* holder for boyer/moore PTR */
    NULL, /* more holder info - byteform */
    0, /* byteform length */
    0 /* increment length*/
};

static RuleOption rule17744option1 = 
{
    OPTION_TYPE_CONTENT,
    {
        &rule17744content1
    }
};
// isdataat:offset 25, relative, payload raw;
static CursorInfo rule17744isdataat2 =
{
    36, /* offset */
    CONTENT_RELATIVE|CONTENT_BUF_NORMALIZED /* flags */
};

static RuleOption rule17744option2 =
{
    OPTION_TYPE_CURSOR,
    {
        &rule17744isdataat2
    }
};
// content:"|FF|SMB2", distance 28, relative; 
static ContentInfo rule17744content3 =
{
    (uint8_t *) "|FF|SMB2", /* pattern (now in snort content format) */
    0, /* depth */
    28, /* offset */
    CONTENT_RELATIVE|CONTENT_BUF_NORMALIZED, /* flags */
    NULL, /* holder for boyer/moore PTR */
    NULL, /* more holder info - byteform */
    0, /* byteform length */
    0 /* increment length*/
};

static RuleOption rule17744option3 =
{
    OPTION_TYPE_CONTENT,
    {
        &rule17744content3
    }
};
#endif

// random string to disable rule
static ContentInfo rule17744content4 =
{
    (uint8_t *) "asefasefasefp8owerq4389rq89r43980tw5t890g8sdr89g7sdfg890srdgh945ht892htwe9hre9grg78952htw78reth8g7hsfdigufdgh", /* pattern (now in snort content format) */
    0, /* depth */
    28, /* offset */
    CONTENT_RELATIVE|CONTENT_BUF_NORMALIZED|CONTENT_FAST_PATTERN, /* flags */
    NULL, /* holder for boyer/moore PTR */
    NULL, /* more holder info - byteform */
    0, /* byteform length */
    0 /* increment length*/
};

static RuleOption rule17744option4 =
{
    OPTION_TYPE_CONTENT,
    {
        &rule17744content4
    }
};


/* references for sid 17744 */
/* reference: cve "2005-0045"; */
static RuleReference rule17744ref1 = 
{
    "cve", /* type */
    "2005-0045" /* value */
};

/* reference: url "www.microsoft.com/technet/security/bulletin/MS05-011.mspx"; */
static RuleReference rule17744ref2 = 
{
    "url", /* type */
    "www.microsoft.com/technet/security/Bulletin/MS05-011.mspx" /* value */
};

static RuleReference *rule17744refs[] =
{
    &rule17744ref1,
    &rule17744ref2,
    NULL
};

#if 0
/* metadata for sid 17744 */
/* metadata:service netbios-ssn, policy balanced-ips drop, policy security-ips drop; */
static RuleMetaData rule17744service1 = 
{
    "service netbios-ssn"
};

static RuleMetaData rule17744policy1 =
{
    "policy security-ips drop"
};
#endif

static RuleMetaData *rule17744metadata[] =
{
//    &rule17744service1,
//    &rule17744policy1,
    NULL
};

RuleOption *rule17744options[] =
{
//    &rule17744option0,
//    &rule17744option1,
//    &rule17744option2,
//    &rule17744option3,
    &rule17744option4,
    NULL
};

Rule rule17744 = {
   /* rule header, akin to => tcp any any -> any any */
   {
       IPPROTO_TCP, /* proto */
       "$EXTERNAL_NET", /* SRCIP     */
       "445", /* SRCPORT   */
   
       0, /* DIRECTION */
       "$HOME_NET", /* DSTIP     */
   
       "any", /* DSTPORT   */
   },
   /* metadata */
   { 
       3,  /* genid */
       17744, /* sigid */
       7, /* revision */
       "attempted-admin", /* classification */
       0,  /* hardcoded priority XXX NOT PROVIDED BY GRAMMAR YET! */
       "DELETED NETBIOS SMB client TRANS response paramcount overflow attempt",     /* message */
       rule17744refs /* ptr to references */
       ,rule17744metadata
   },
   rule17744options, /* ptr to rule options */
   &rule17744eval, /* replace with NULL to use the built in detection function */
   1 //0 /* am I initialized yet? */
};


/* detection functions */
int rule17744eval(void *p) {

    return RULE_NOMATCH;

#if 0
    const uint8_t *cursor_normal = 0;
    SFSnortPacket *sp = (SFSnortPacket *) p;

    const uint8_t *beg_of_payload, *end_of_payload;
    uint16_t paramcount = 0;
    uint16_t totalparamcount = 0;

    if(sp == NULL)
        return RULE_NOMATCH;

    if(sp->payload == NULL)
        return RULE_NOMATCH;
    
    // flow:established, to_client;
    if (checkFlow(p, rule17744options[0]->option_u.flowFlags) > 0 ) {
        // content:"|FF|SMB2", payload raw, offset 4, depth 5, fast_pattern;
        if (contentMatch(p, rule17744options[1]->option_u.content, &cursor_normal) > 0) {
            // isdataat:offset 36, relative, payload raw;
            if (checkCursor(p, rule17744options[2]->option_u.cursor, cursor_normal) > 0) {

                // Hack to get around improper reassembly of SMB packets causing false positives
                // If we see another SMB header, we're looking at two packets together so bail.
                if (contentMatch(p, rule17744options[3]->option_u.content, &cursor_normal) > 0) 
                    return RULE_NOMATCH;

                if(getBuffer(sp, CONTENT_BUF_NORMALIZED, &beg_of_payload, &end_of_payload) <= 0)
                     return RULE_NOMATCH;

                totalparamcount = *(cursor_normal+28);
                totalparamcount |= *(cursor_normal+29) << 8;
                paramcount = *(cursor_normal+34);
                paramcount |= *(cursor_normal+35) << 8;

                if (paramcount > totalparamcount)
                    return RULE_MATCH;
            }
        }
    }
    return RULE_NOMATCH;
#endif
}

/*
Rule *rules[] = {
    &rule17744,
    NULL
};
*/

